CVE-2026-81648 hits the WordPress plugin CryptoPayment Gateway in versions 1.2.1 and 1.2.2. The flaw lets unauthenticated callers invoke administrative operations through an unguarded AJAX endpoint — including deleting arbitrary files, overwriting gateway settings and recovering stored wallet credentials in cleartext. WPScan and NVD entries rate it critical (CVSS 10.0). On November 3, 2026, The Hacker News reported active in-the-wild exploitation attempts, citing Defused Cyber.
Primary sources for this overview are the WPScan entry for CVE-2026-81648 and The Hacker News report from November 3. We describe impact and operator guidance at a high level — without reproducible attack steps.
CVE-2026-81648: what is affected
CryptoPayment Gateway (slug cryptopayment-gateway) is a WordPress plugin for crypto payments. Per WPScan, versions 1.2.1 through 1.2.2 are affected; there is no known fix. Wordfence Intelligence lists the same CVE as unpatched. As of August 28, 2026 the plugin was closed on the WordPress.org Plugin Directory and is no longer available for download, citing a “security issue.”
The Hacker News cites roughly 1,845 cumulative downloads, including 20 in the seven days before its article. How many sites still run the plugin is unclear. Small install bases often look safe until scanners sweep the internet for every known slug.
Impact: admin operations without a login
According to WPScan, one of the plugin’s AJAX routers lacks an authorization check. Unauthenticated callers can then trigger administrative operations. Publicly documented effects include:
- Reading and overwriting gateway configuration
- Recovering stored wallet key material in cleartext via a decryption routine exposed on the same router
- Deleting arbitrary files through unsafe path handling — in the extreme case including core WordPress configuration files, which can force a reinstall against an attacker-controlled database
WPScan classifies the issue as broken access control (OWASP A5 / CWE-284). Researcher Pedro Pinho submitted the entry; public disclosure was September 10, 2026. Wordfence also carried the vulnerability in its mid-September weekly report as a critical, unpatched arbitrary file deletion.
For context: a sibling router in the same plugin is said by WPScan to reject the same request with a security error. The unguarded variant is enough for the operations above without a session.
Active exploitation on November 3
What is new on the afternoon of November 3 is not the CVE itself — it has been public since September — but reports of live scanning and exploitation attempts. Defused Cyber said, according to The Hacker News, that it is observing in-the-wild attempts against CVE-2026-81648, with traffic from infrastructure marketing “Anonymous KYC-Free VPS Hosting.”
The pattern matches other critical WordPress and web flaws: once PoCs and scanner signatures circulate, hit rates rise even for low-download plugins. Meanwhile the plugin remains unfixed and off the official directory — operators have to act themselves.
What operators should do now
With no patch available, removal is the clear recommendation from The Hacker News and standard incident playbooks:
- Deactivate the plugin and remove it fully from the server
- Treat any wallet keys or seed material stored through the plugin as compromised and rotate them — ideally from a clean device into new wallets
- Audit configuration, filesystem and user accounts for suspicious changes (unknown admins, altered gateway settings, missing core files)
- Preserve logs and backups before cleanup; if compromise is likely, rebuild the instance instead of “patching in place”
Teams that still need crypto payments on WordPress should move to actively maintained alternatives with a clear update policy — not a closed, unpatched directory plugin.
Context alongside related incidents
CVE-2026-81648 sits in a run of critical payment and platform flaws. On code404zero we recently covered drained hot wallets on outdated BTCPay instances, the PHP2Shell RCE wave and actively exploited GitLab CVEs such as CVE-2026-97229. Broader WordPress changes like the SQL mode shift in WordPress 7.2 belong in the same ops conversation: updates, least privilege and fast response to unpatched plugins.
Why unpatched small plugins stay dangerous
Many operators prioritize updates by install counts. CVE-2026-81648 shows the weakness of that heuristic: a plugin with low four-digit downloads can still expose wallet keys and the filesystem once scanners know the slug. Closed in the directory does not mean “removed from every server” — old ZIP installs and mirror copies remain live.
For hosting and agency teams an inventory check pays off: which payment plugins are installed, when were they last updated, who has commit rights? Especially for crypto gateways, secrets should not live permanently in plugin storage, and emergency rotation needs practice before the CVE hits the feed.
In practice that means monitoring teams should put the plugin slug cryptopayment-gateway and unusual requests under the plugin path on the watchlist. The mere presence of the directory under wp-content/plugins/ is a signal, even if the plugin looks deactivated. Managed WordPress customers should ask their host whether automated malware and CVE scans already cover this CVE.
For developers of payment plugins the lesson is banal and expensive at once: every publicly reachable endpoint under the plugin path needs the same authorization as wp-admin — including nonces and capability checks. Vendor folders with custom AJAX routers are especially brittle because they often bypass WordPress hooks. Code review and automated checks for unauthenticated admin actions belong in every release gate.
What remains open
Publicly unclear are the exact number of active installs, whether successful wallet thefts already map to this CVE, and whether the original maintainer will ship a fix. The WordPress.org closure and WPScan’s “no known fix” currently argue against a quick catalog remediation.
For newsrooms and operators that means: the CVE is old enough for scanners and fresh enough for active campaigns. Anyone who ever installed CryptoPayment Gateway — even disabled — should check inventory, filesystem and wallet keys. A high CVSS alone is not drama; a missing patch plus observed exploitation is.
